# ModHeader Chrome/Edge Extension (v7.0.17-7.0.18, 1.6M Installs) Contains Dormant AES-GCM Browsing-History Exfiltration Pipeline to api.stanfordstudies.com

> ModHeader, a legitimate developer HTTP header-modification extension with ~900,000 Chrome and ~700,000 Edge installs (1.6M combined), shipped a fully-built but allow-list-gated browsing-history collection and exfiltration pipeline in versions 7.0.17-7.0.18. The pipeline fingerprints the device, encrypts every visited domain with a hardcoded AES-GCM key, stages it in IndexedDB, and would upload it once daily on a per-device jittered schedule to api.stanfordstudies.com/app/log — while the extension also actively beaconed install/update/uninstall telemetry to extensions-hub.com. Microsoft pulled the Edge listing on 2026-07-03 and Google removed/flagged the Chrome listing as malware on 2026-07-10.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1289
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-modheader-chrome-extension-spyware-tl-2026-1289.webp?v=c0368080 (Threadlinqs threat intel: ModHeader 7.0.18 Extension Spyware: Detection & IOCs (TL-2026-1289) — High severity, 17 IOCs, 9 detection rules.)
- **ID:** TL-2026-1289
- **Severity:** HIGH (CVSS 7.5)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (3 shown free below)

## Description

ModHeader (Chrome extension ID idgpnmonknjnojddfkpgkljpfnnfcklj, Edge extension ID opgbiafapkbbnbnjcdomjaghbckfkglc) is a widely-used developer tool for modifying HTTP request/response headers, with roughly 900,000 Chrome users and 700,000 Edge users. Independent reverse-engineering by researcher Yunus Aydin, UK security firm Stripe OLT, and outlet HackIndex found that the extension's background service worker (bundled in files named background-94ad634d.js / background-c2ed2c3f.js and disguised inside a file resembling the dayjs.min library) contains a complete, production-ready data-collection-and-exfiltration framework that requires no further permission grant to activate.

On install/startup, function jw() builds a per-device fingerprint (SHA-256 of Date.now().toString()) and a 12-byte random AES-GCM IV, both persisted in an IndexedDB 'settings' object store. Function Jw() hooks chrome.tabs.onUpdated to observe every URL the user navigates to; Zw() extracts the bare domain from each URL. Domains are encrypted with a hardcoded, base64-encoded AES-GCM key (aWfU3yG_wksZaQdSnxPJBOId0cAN8KK/UIlZbli7-bE) and written to a 'temp' IndexedDB object store, deduplicated with visit counters, up to a cap of 1,000 distinct domains. Function zw() computes a per-install upload delay as SHA-256(fingerprint + 'mod盐header') mod 28800, plus a fixed 25200-second offset, yielding a randomized 7-15 hour daily upload window per device — a jitter scheme designed to avoid synchronized bursts that would be conspicuous in aggregate network telemetry. Once the 1,000-domain cap or the 24-hour window is reached, Qw()/Vw() POST the encrypted domain batch plus the fingerprint and browser/user-agent metadata to https://api.stanfordstudies.com/app/log with up to 3 retries at 1-second intervals, then clear the 'temp' store to remove local evidence of the transmission.

Critically, in the analyzed 7.0.18 build the collection path is gated behind an empty client-side allow-list, so Zw() never actually fires and no domains are staged or uploaded in the observed build — researchers found no evidence of live exfiltration. However, because the entire pipeline (fingerprinting, encryption, storage, scheduling, retry logic, and evidence-clearing) already ships inside the extension, a routine update that simply populated the allow-list could silently activate mass browsing-history collection across 1.6M installs without any new permission prompt or user awareness, which is the basis for Microsoft's and Google's malware classifications.

Independently of the dormant collector, ModHeader is confirmed to actively beacon lifecycle telemetry (install, update, uninstall events with extension name, version, and browser type) to extensions-hub.com/partners/ at all times — this component is live, not gated. Infrastructure analysis found that api.stanfordstudies.com and extensions-hub.com resolve to the same AWS us-east-2-hosted IP address (3.147.61.167), suggesting shared operator infrastructure. stanfordstudies.com is a repurposed, aged domain with no actual affiliation to Stanford University, fronting an exposed OpenSearch cluster built in September 2024 that researchers assess is sized for large-scale telemetry ingestion rather than the small analytics use its branding implies.

Weak, non-definitive attribution signals noted by researchers include a Simplified Chinese browser-locale default, the embedded Unicode character '盐' (Chinese for 'salt') used as a string-obfuscation technique against static keyword searches in the jitter-seed calculation, and use of a China-origin mail provider by the domain registrant — researchers stopped short of formal group attribution. The incident is framed by multiple outlets as a 'monetization pivot': ModHeader drew user complaints in 2023 for injecting ads into search results after transitioning to an ad-supported model, consistent with a broader pattern (also referenced by Brian Krebs in 2021) of popular extensions being acquired and quietly converted into data-collection pipelines. Because ModHeader is disproportionately used by developers, QA engineers, and cloud administrators, the affected install base carries elevated exposure of internal corporate domains, VPN portals, identity-provider login pages, and cloud-console URLs versus a general consumer extension.

On 2026-07-10 (per Reddit report from u/veqtor and researcher timelines) anomalous network requests were first noticed; full reverse engineering completed 2026-07-11-07-12; Stripe OLT and Yunus Aydin published detailed technical writeups 2026-07-12-07-14. Microsoft removed the Edge listing on 2026-07-03 (ahead of public disclosure, suggesting a private vendor report), and Google removed the Chrome Web Store listing and flagged it as malware on 2026-07-10. A queried BeaconBeagle C2 configuration search for stanfordstudies.com returned zero correlated records at time of research, indicating no prior tracked malware family has been publicly linked to this specific infrastructure.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1176 Software Extensions
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1480 Execution Guardrails
- T1518 Software Discovery
- T1005 Data from Local System
- T1185 Browser Session Hijacking
- T1560 Archive Collected Data
- T1074 Data Staged
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1029 Scheduled Transfer
- T1592 Gather Victim Host Information
- T1583 Acquire Infrastructure
- T1585 Establish Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Jittered Daily HTTPS POST to stanfordstudies.com / extensions-hub.com Shared C2 Infrastructure (C2/Exfiltration)** (`TL-2026-1289-SPL-003`)

Detects outbound HTTPS POST traffic from a browser process to the known ModHeader exfiltration/telemetry infrastructure (api.stanfordstudies.com/app/log, extensions-hub.com/partners/, or the shared AWS IP 3.147.61.167), including the single-per-24h jittered upload pattern (7-15 hour randomized daily window) that evades fixed-schedule beacon detection.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1573.001, T1041, T1029
- **Data sources:** proxy_logs, firewall_logs, dns_logs, edr_network_telemetry
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=proxy OR index=firewall sourcetype IN ("squid:access", "pan:traffic", "stream:http")
(dest_host="api.stanfordstudies.com" OR dest_host="*.stanfordstudies.com" OR dest_host="extensions-hub.com" OR dest_host="*.extensions-hub.com" OR dest_ip="3.147.61.167") method=POST
| eval uri_path=coalesce(uri_path, url_path)
| where uri_path="/app/log" OR uri_path="/partners/" OR uri_path LIKE "%partners%"
| bin _time span=1d
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_host) as dest_host by src_ip, user, uri_path
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| table src_ip, user, dest_host, uri_path, count, first_seen, last_seen
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("stanfordstudies.com", "extensions-hub.com") or RemoteIP == "3.147.61.167"
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| summarize ConnectionCount=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| order by LastSeen desc
```

### Sigma

```yaml
title: Outbound HTTPS POST to ModHeader stanfordstudies/extensions-hub C2 Infrastructure
id: 1289a1c3-0003-4a2b-9c3d-tl20261289003
status: experimental
description: Detects outbound network connections from a browser process to the known ModHeader exfiltration endpoint (api.stanfordstudies.com), lifecycle-beacon endpoint (extensions-hub.com), or the shared AWS-hosted destination IP 3.147.61.167.
references:
    - https://cybersecuritynews.com/chrome-extension-used-million-users-data-exfiltration/
    - https://radar.offseq.com/threat/16-million-combined-installs-famous-extension-modh-b12ce9577a362d5d
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/07/14
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1573.001
    - attack.exfiltration
    - attack.t1041
    - attack.t1029
logsource:
    category: network_connection
    product: any
detection:
    selection:
        DestinationHostname|endswith:
            - 'stanfordstudies.com'
            - 'extensions-hub.com'
        Initiated: true
    selection_ip:
        DestinationIp: '3.147.61.167'
    condition: selection or selection_ip
falsepositives:
    - None expected; these are threat-specific IOC domains/IP with no legitimate business use
level: critical
```

**Known false positives:**

- None expected; these are threat-specific IOC domains/IP with no legitimate business use

**Tuning notes:** Immediately blocklist these domains/IP at DNS and proxy rather than relying solely on detection; keep the rule active post-blocklisting to catch any devices bypassing the proxy.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ModHeader Extension Install/Update via Chrome/Edge Management Telemetry (Exploitation - Supply Chain) (locked: unlock with TL Creds)
- Device Fingerprinting and AES Key Material Persisted in Extension IndexedDB Settings Store (Post-Exploitation - Collection) (locked: unlock with TL Creds)
- Browser Process Beaconing to Shared AWS-Hosted C2 Infrastructure with Encrypted Payload Retry Pattern (C2/Exfiltration) (locked: unlock with TL Creds)
- Chrome/Edge Software Inventory Discovery of Flagged ModHeader Extension IDs (Exploitation - Discovery/Supply Chain) (locked: unlock with TL Creds)
- Browsing Domains Staged and Deduplicated in Extension Temp Store with Visit-Count Encryption Pattern (Post-Exploitation - Collection/Archival) (locked: unlock with TL Creds)
- DNS Resolution Correlating Repurposed Domain and Telemetry Domain to Shared Infrastructure with Unicode-Obfuscated Seed String (C2/Lateral - Infrastructure Correlation) (locked: unlock with TL Creds)
- ModHeader Malicious Extension Install/Update Detected (Exploitation - Supply Chain) (locked: unlock with TL Creds)
- Browser Extension IndexedDB Fingerprint/Key Staging and Stage-Then-Clear Evidence Removal (Post-Exploitation - Collection) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 17)

Defanged, TLP:CLEAR.

- IP address: `3.147.61[.]167`
- Domain: `stanfordstudies[.]com`
- Domain: `extensions-hub[.]com`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Chrome Extension Used by Million Users Caught in Data Exfiltration Scheme](https://cybersecuritynews.com/chrome-extension-used-million-users-data-exfiltration/)
- [ModHeader: Covert Data Exfiltration to api.stanfordstudies.com](https://aydinnyunus.github.io/2026/07/12/modheader-data-exfiltration-stanfordstudies/)
- [Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found](https://thehackernews.com/2026/07/google-and-microsoft-pull-modheader.html)
- [ModHeader Malware: Inside the Chrome Spyware Google Removed](https://hackindex.io/research/modheader-malware-chrome-spyware)
- [ModHeader Chrome Extension Exposes 900,000 Users to Hidden Data Exfiltration Risk](https://cyberpress.org/modheader-chrome-extension-exposes-900000/)
- [How to Remove the ModHeader Malware (v7.0.18): Full Cleanup & Self-Check Guide](https://www.vibeheader.com/blog/remove-modheader-malware-cleanup-guide/)
- [ModHeader Flagged as Malware: Why I Built VibeHeader (Founder's Take)](https://www.vibeheader.com/blog/modheader-malware-why-i-built-vibeheader/)
- [1.6 Million combined installs famous extension ModHeader removed for Malware - Threat Radar](https://radar.offseq.com/threat/16-million-combined-installs-famous-extension-modh-b12ce9577a362d5d)
- [ModHeader Malware Warning: Remove Extension 7.0.18](https://blog.gridinsoft.com/modheader-malware/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1289